# CVEs published 2025-05-22

136 CVEs were published on May 22, 2025: 12 critical, 56 high. Days are UTC.

- [CVE-2025-4692](https://cve.now/CVE-2025-4692.md): ABUP IoT Cloud Platform Incorrect Privilege Assignment (CVSS 6.8, ABUP IoT Cloud Platform)
- [CVE-2025-4338](https://cve.now/CVE-2025-4338.md): Lantronix Device Installer Improper Restriction of XML External Entity Reference (CVSS 6.9, Lantronix Device Installer)
- [CVE-2025-48371](https://cve.now/CVE-2025-48371.md): OpenFGA Authorization Bypass (CVSS 5.8, openfga · github.com/openfga/openfga)
- [CVE-2025-47181](https://cve.now/CVE-2025-47181.md): Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Edge (Chromium-based) Updater)
- [CVE-2025-4975](https://cve.now/CVE-2025-4975.md): Tapo privilege escalation on shared devices using notifications (CVSS 4.8, TP-Link Systems TP-Link Tapo app)
- [CVE-2025-48374](https://cve.now/CVE-2025-48374.md): zot logs secrets (CVSS 5.5, project-zot zot · zotregistry.dev/zot)
- [CVE-2025-48373](https://cve.now/CVE-2025-48373.md): Schule Has Client-Side Role-Based Access Control (RBAC) Bypass Vulnerability (CVSS 6.6, schule111 Schule)
- [CVE-2025-48372](https://cve.now/CVE-2025-48372.md): Schule Has Insecure OTP Length, is Susceptible to Brute-Force Attacks (CVSS 6.6, schule111 Schule)
- [CVE-2024-5962](https://cve.now/CVE-2024-5962.md): Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding (CVSS 6.1, WSO2 API Manager · WSO2 Identity Server)
- [CVE-2024-7487](https://cve.now/CVE-2024-7487.md): Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication (CVSS 5.8, WSO2 Identity Server · WSO2 Client Attestation Filter +1)
- [CVE-2024-7103](https://cve.now/CVE-2024-7103.md): Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login Flow (CVSS 4.6, WSO2 Identity Server)
- [CVE-2024-51552](https://cve.now/CVE-2024-51552.md): Weak Password Storage (CVSS 7.1, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13958](https://cve.now/CVE-2024-13958.md): Stored Cross Site Scripting (CVSS 4.6, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13957](https://cve.now/CVE-2024-13957.md): SSRF Server Side Request Forgery (CVSS 7.0, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13956](https://cve.now/CVE-2024-13956.md): SSL Verification Bypass (CVSS 8.8, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13955](https://cve.now/CVE-2024-13955.md): SQL Injection 2nd Order (CVSS 9.4, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13954](https://cve.now/CVE-2024-13954.md): Serialization / Deserialization of configuration data (CVSS 5.1, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13953](https://cve.now/CVE-2024-13953.md): Sensitive Information disclosed in log files (CVSS 6.9, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13952](https://cve.now/CVE-2024-13952.md): Remote Code Execution (CVSS 8.7, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-6914](https://cve.now/CVE-2024-6914.md): Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover (CVSS 9.8, WSO2 API Manager · WSO2 Governance Registry +6)
- [CVE-2024-51553](https://cve.now/CVE-2024-51553.md): Predictable Filename (CVSS 7.0, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13951](https://cve.now/CVE-2024-13951.md): One way hash with predictable salt (CVSS 6.1, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13950](https://cve.now/CVE-2024-13950.md): Log Injection (CVSS 6.9, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13949](https://cve.now/CVE-2024-13949.md): Log Forging (CVSS 6.9, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-48848](https://cve.now/CVE-2024-48848.md): LARGECONTENT - device disk overutilization (CVSS 7.0, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13948](https://cve.now/CVE-2024-13948.md): Insecure Permissions (CVSS 6.9, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13947](https://cve.now/CVE-2024-13947.md): External System or Configuration Control (CVSS 7.1, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13946](https://cve.now/CVE-2024-13946.md): Binary Planting / LoadLibrary DLL's not Signed (CVSS 7.1, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13931](https://cve.now/CVE-2024-13931.md): Authenticated Relative Path Traversal (CVSS 7.5, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13930](https://cve.now/CVE-2024-13930.md): Authenticated Unchecked Loop Condition (CVSS 5.9, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13929](https://cve.now/CVE-2024-13929.md): Authenticated Servlet Command Injection (CVSS 7.5, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-13928](https://cve.now/CVE-2024-13928.md): Authenticated SQL Injection (CVSS 7.5, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-30169](https://cve.now/CVE-2025-30169.md): Admin Authorized File Upload and Execute PHP (CVSS 6.0, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-30173](https://cve.now/CVE-2025-30173.md): Admin Authorized File Upload (CVSS 6.0, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-30172](https://cve.now/CVE-2025-30172.md): Admin Authorized Remote Code Execution (CVSS 8.9, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-30171](https://cve.now/CVE-2025-30171.md): Admin Authorized System File Deletion (CVSS 7.3, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-30170](https://cve.now/CVE-2025-30170.md): Admin Authorized Exposure of file path, file size or file existence (CVSS 5.9, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-2409](https://cve.now/CVE-2025-2409.md): Admin Authorized System File corruption (CVSS 8.9, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-48369](https://cve.now/CVE-2025-48369.md): GroupOffice vulnerable to Stored XSS in Tasks Comment Section (CVSS 5.3, Intermesh groupoffice)
- [CVE-2025-2410](https://cve.now/CVE-2025-2410.md): Admin Authorized Port (iptables) manipulation (open/close/disable ports) (CVSS 8.9, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-48368](https://cve.now/CVE-2025-48368.md): GroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript Execution (CVSS 5.8, Intermesh groupoffice)
- [CVE-2025-48366](https://cve.now/CVE-2025-48366.md): GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions (CVSS 6.9, Intermesh groupoffice)
- [CVE-2024-9639](https://cve.now/CVE-2024-9639.md): Authenticated Remote Code Execution (CVSS 7.5, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-48075](https://cve.now/CVE-2025-48075.md): Fiber panics when fiber.Ctx.BodyParser parses invalid range index (CVSS 7.7, gofiber fiber · github.com/gofiber/fiber/v2 +1)
- [CVE-2025-48066](https://cve.now/CVE-2025-48066.md): wire-webapp has no database deletion on client logout (CVSS 6.0, wireapp wire-webapp)
- [CVE-2025-48061](https://cve.now/CVE-2025-48061.md): wire-webapp Has Insufficient Session Invalidation after User Logout (CVSS 5.6, wireapp wire-webapp)
- [CVE-2025-47780](https://cve.now/CVE-2025-47780.md): cli\_permissions.conf: deny option does not work for disallowing shell commands (CVSS 4.8, asterisk)
- [CVE-2025-47779](https://cve.now/CVE-2025-47779.md): Using malformed From header can forge identity with ";" or NULL in name portion (CVSS 7.7, asterisk)
- [CVE-2025-46716](https://cve.now/CVE-2025-46716.md): Sandboxie Arbitrary Kernel Read in SbieDrv.sys API (API\_SET\_SECURE\_PARAM) (CVSS 5.5, sandboxie-plus Sandboxie)
- [CVE-2025-43596](https://cve.now/CVE-2025-43596.md): MSP360 Backup (for Windows) insecure filesystem permissions (CVSS 7.8, MSP360 Backup)
- [CVE-2025-46715](https://cve.now/CVE-2025-46715.md): Sandboxie Arbitrary Kernel Write in SbieDrv.sys API (API\_GET\_SECURE\_PARAM) (CVSS 7.8, sandboxie-plus Sandboxie)
- [CVE-2024-48850](https://cve.now/CVE-2024-48850.md): Authenticated Absolute Path Traversal (CVSS 7.5, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-48853](https://cve.now/CVE-2024-48853.md): Authenticated Escalation to guest to root (CVSS 9.5, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-33138](https://cve.now/CVE-2025-33138.md): IBM Aspera Faspex HTML injection (CVSS 5.4, IBM Aspera Faspex)
- [CVE-2025-33137](https://cve.now/CVE-2025-33137.md): IBM Aspera Faspex data modification (CVSS 7.1, IBM Aspera Faspex)
- [CVE-2025-33136](https://cve.now/CVE-2025-33136.md): IBM Aspera Faspex data modification (CVSS 7.1, IBM Aspera Faspex)
- [CVE-2025-4366](https://cve.now/CVE-2025-4366.md): Request Smuggling Vulnerability in Pingora (CVSS 7.4, Pingora · pingora-core)
- [CVE-2025-23183](https://cve.now/CVE-2025-23183.md): UBtech – CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (CVSS 6.1, UBtech Freepass)
- [CVE-2025-5081](https://cve.now/CVE-2025-5081.md): Campcodes Cybercafe Management System adminprofile.php sql injection (CVSS 6.9, Campcodes Cybercafe Management System)
- [CVE-2025-23182](https://cve.now/CVE-2025-23182.md): UBtech – CWE-203: Observable Discrepancy (CVSS 4.3, UBtech Freepass)
- [CVE-2025-2506](https://cve.now/CVE-2025-2506.md): When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access t (CVSS 5.3, EnterpriseDB pglogical · EnterpriseDB BDR/PGD)
- [CVE-2025-5080](https://cve.now/CVE-2025-5080.md): Tenda FH451 webExcptypemanFilter stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2025-5024](https://cve.now/CVE-2025-5024.md): Gnome-remote-desktop: uncontrolled resource consumption due to malformed rdp pdus (CVSS 7.4, Red Hat Enterprise Linux)
- [CVE-2024-12093](https://cve.now/CVE-2024-12093.md): Improper Validation of Consistency within Input in GitLab (CVSS 6.8, GitLab)
- [CVE-2025-0605](https://cve.now/CVE-2025-0605.md): Weak Authentication in GitLab (CVSS 4.6, GitLab)
- [CVE-2025-0679](https://cve.now/CVE-2025-0679.md): Exposure of Private Personal Information to an Unauthorized Actor in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-0993](https://cve.now/CVE-2025-0993.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-5079](https://cve.now/CVE-2025-5079.md): PHPGurukul/Campcodes Online Shopping Portal updateorder.php sql injection (CVSS 6.9, PHPGurukul Online Shopping Portal · Campcodes Online Shoppi…)
- [CVE-2025-32915](https://cve.now/CVE-2025-32915.md): Sensitive data exposed during automatic agent updates (CVSS 4.3, Checkmk)
- [CVE-2025-1110](https://cve.now/CVE-2025-1110.md): Insufficient Granularity of Access Control in GitLab (CVSS 2.7, GitLab)
- [CVE-2025-5078](https://cve.now/CVE-2025-5078.md): PHPGurukul/Campcodes Online Shopping Portal subcategory.php sql injection (CVSS 6.9, PHPGurukul Online Shopping Portal · Campcodes Online Shoppi…)
- [CVE-2025-5077](https://cve.now/CVE-2025-5077.md): Campcodes Online Shopping Portal edit-subcategory.php sql injection (CVSS 6.9, Campcodes Online Shopping Portal)
- [CVE-2025-4575](https://cve.now/CVE-2025-4575.md): The x509 application adds trusted use instead of rejected use (CVSS 6.5, OpenSSL)
- [CVE-2025-5076](https://cve.now/CVE-2025-5076.md): FreeFloat FTP Server SEND Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-2853](https://cve.now/CVE-2025-2853.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-3111](https://cve.now/CVE-2025-3111.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-4979](https://cve.now/CVE-2025-4979.md): Insufficient Granularity of Access Control in GitLab (CVSS 4.9, GitLab)
- [CVE-2025-3945](https://cve.now/CVE-2025-3945.md): Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’) (CVSS 7.2, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-3944](https://cve.now/CVE-2025-3944.md): Incorrect Permission Assignment for Critical Resource (CVSS 7.2, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-3943](https://cve.now/CVE-2025-3943.md): Use of GET Request Method With sensitive Query Strings (CVSS 4.1, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-3942](https://cve.now/CVE-2025-3942.md): Improper Output Neutralization for Logs (CVSS 4.3, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-3941](https://cve.now/CVE-2025-3941.md): Improper Handling of Windows: DATA Alternate Data Stream (CVSS 5.4, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-3940](https://cve.now/CVE-2025-3940.md): Improper Use of Validation Framework (CVSS 5.3, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-3939](https://cve.now/CVE-2025-3939.md): Observable Response Discrepancy (CVSS 5.3, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-3938](https://cve.now/CVE-2025-3938.md): Missing Cryptographic Step (CVSS 6.8, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-5075](https://cve.now/CVE-2025-5075.md): FreeFloat FTP Server DEBUG Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-46714](https://cve.now/CVE-2025-46714.md): Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API\_GET\_SECURE\_PARAM) (CVSS 7.8, sandboxie-plus Sandboxie)
- [CVE-2025-3937](https://cve.now/CVE-2025-3937.md): Use of Password Hash with Insufficient Computational Effort (CVSS 7.7, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-46713](https://cve.now/CVE-2025-46713.md): Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API\_SET\_SECURE\_PARAM) (CVSS 7.8, sandboxie-plus Sandboxie)
- [CVE-2025-2272](https://cve.now/CVE-2025-2272.md): Privilege Escalation and Arbitrary code execution in F1E Endpoint (CVSS 7.0, Forcepoint FIE Endpoint)
- [CVE-2025-3936](https://cve.now/CVE-2025-3936.md): Incorrect Permission Assignment for Critical Resource (CVSS 6.5, Tridium Niagara Framework · Tridium Niagara Enterprise Secu…)
- [CVE-2025-5074](https://cve.now/CVE-2025-5074.md): FreeFloat FTP Server PROMPT Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5073](https://cve.now/CVE-2025-5073.md): FreeFloat FTP Server MKDIR Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-41403](https://cve.now/CVE-2025-41403.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2025-3836](https://cve.now/CVE-2025-3836.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2025-3444](https://cve.now/CVE-2025-3444.md): Local File Inclusion (CVSS 6.5, ManageEngine ServiceDesk Plus MSP · ManageEngine SupportCen…)
- [CVE-2024-25010](https://cve.now/CVE-2024-25010.md): Ericsson RAN Compute and Site Controller 6610 - Improper Input Validation Vulnerability (CVSS 8.8, Ericsson RAN Compute Basebands · Ericsson Site Controller)
- [CVE-2025-4280](https://cve.now/CVE-2025-4280.md): TCC Bypass via Inherited Permissions in Bundled Interpreter in Poedit.app (CVSS 4.8, Poedit)
- [CVE-2025-4419](https://cve.now/CVE-2025-4419.md): Hot Random Image \<= 1.9.2 - Path Traversal to Authenticated (Contributor+) Limited Arbitrary Image Access via path Parameter (CVSS 4.3, hotwptemplates Hot Random Image)
- [CVE-2025-4405](https://cve.now/CVE-2025-4405.md): Hot Random Image \<= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter (CVSS 4.9, hotwptemplates Hot Random Image)
- [CVE-2024-9544](https://cve.now/CVE-2024-9544.md): MapSVG - All Kinds of Maps and Store Locator for WordPress \<= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, MapSVG)
- [CVE-2025-4123](https://cve.now/CVE-2025-4123.md): A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. (CVSS 7.6, Grafana · github.com/grafana/grafana)
- [CVE-2025-4133](https://cve.now/CVE-2025-4133.md): Blog2Social: Social Media Auto Post & Scheduler \< 8.4.0 - Contributor+ Stored XSS (CVSS 5.4, Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2025-5062](https://cve.now/CVE-2025-5062.md): WooCommerce \<= 9.4.2 - PostMessage-Based Cross-Site Scripting (CVSS 6.1, automattic WooCommerce)
- [CVE-2025-2759](https://cve.now/CVE-2025-2759.md): GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability (CVSS 7.0, GStreamer)
- [CVE-2025-3486](https://cve.now/CVE-2025-3486.md): Allegra isZipEntryValide Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, Allegra)
- [CVE-2025-3480](https://cve.now/CVE-2025-3480.md): MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability (CVSS 5.3, MedDream WEB DICOM Viewer)
- [CVE-2025-3481](https://cve.now/CVE-2025-3481.md): MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8, MedDream PACS Server)
- [CVE-2025-3482](https://cve.now/CVE-2025-3482.md): MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8, MedDream PACS Server)
- [CVE-2025-3483](https://cve.now/CVE-2025-3483.md): MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8, MedDream PACS Server)
- [CVE-2025-3484](https://cve.now/CVE-2025-3484.md): MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8, MedDream PACS Server)
- [CVE-2025-3885](https://cve.now/CVE-2025-3885.md): Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability (CVSS 5.3, Harman Becker MGU21)
- [CVE-2025-3884](https://cve.now/CVE-2025-3884.md): Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, Cloudera Hue)
- [CVE-2025-3883](https://cve.now/CVE-2025-3883.md): eCharge Hardy Barth cPH2 index.php Command Injection Remote Code Execution Vulnerability (CVSS 8.8, eCharge Hardy Barth cPH2)
- [CVE-2025-3882](https://cve.now/CVE-2025-3882.md): eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability (CVSS 8.8, eCharge Hardy Barth cPH2)
- [CVE-2025-3881](https://cve.now/CVE-2025-3881.md): eCharge Hardy Barth cPH2 check\_req.php ntp Command Injection Remote Code Execution Vulnerability (CVSS 8.8, eCharge Hardy Barth cPH2)
- [CVE-2025-3887](https://cve.now/CVE-2025-3887.md): GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, GStreamer)
- [CVE-2023-47466](https://cve.now/CVE-2023-47466.md): TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is t (CVSS 2.9, TagLib)
- [CVE-2024-40458](https://cve.now/CVE-2024-40458.md): An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets. (CVSS 7.8)
- [CVE-2024-40459](https://cve.now/CVE-2024-40459.md): An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager function (CVSS 7.8)
- [CVE-2024-40460](https://cve.now/CVE-2024-40460.md): An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the JOBENTRY.EXE (CVSS 7.8)
- [CVE-2024-40461](https://cve.now/CVE-2024-40461.md): An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the STOCKORDERENTRY.EXE component (CVSS 7.8)
- [CVE-2024-40462](https://cve.now/CVE-2024-40462.md): An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the SETTINGSVATIGATOR.EXE component (CVSS 7.8)
- [CVE-2024-41195](https://cve.now/CVE-2024-41195.md): An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Admini (CVSS 9.8)
- [CVE-2024-41196](https://cve.now/CVE-2024-41196.md): An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrat (CVSS 9.8)
- [CVE-2024-41197](https://cve.now/CVE-2024-41197.md): An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator v (CVSS 9.8)
- [CVE-2024-41198](https://cve.now/CVE-2024-41198.md): An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator vi (CVSS 9.8)
- [CVE-2024-41199](https://cve.now/CVE-2024-41199.md): An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator (CVSS 7.2)
- [CVE-2024-52874](https://cve.now/CVE-2024-52874.md): In Infoblox NETMRI before 7.6.1, authenticated users can perform SQL injection attacks. (CVSS 8.8)
- [CVE-2024-54188](https://cve.now/CVE-2024-54188.md): Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access. (CVSS 5.3)
- [CVE-2025-32813](https://cve.now/CVE-2025-32813.md): An issue was discovered in Infoblox NETMRI before 7.6.1. (CVSS 7.2)
- [CVE-2025-32814](https://cve.now/CVE-2025-32814.md): An issue was discovered in Infoblox NETMRI before 7.6.1. (CVSS 9.8)
- [CVE-2025-32815](https://cve.now/CVE-2025-32815.md): An issue was discovered in Infoblox NETMRI before 7.6.1. (CVSS 6.5)
- [CVE-2025-45468](https://cve.now/CVE-2025-45468.md): Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account. (CVSS 8.8)
- [CVE-2025-45471](https://cve.now/CVE-2025-45471.md): Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account. (CVSS 8.8)
- [CVE-2025-45472](https://cve.now/CVE-2025-45472.md): Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-05-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.